Bot Authentication via Nonce Verification in Messaging Apps

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current bot authentication protocols are clunky and insecure, requiring users to manually copy and paste large identification numbers, leading to a subpar user experience and increased network traffic, especially when accessing third-party services like Instagram or Facebook within chat applications.

Innovation Solution

A method where a nonce is generated and transmitted from the web service to the messaging application, allowing the bot to verify user authentication invisibly, eliminating the need for manual credential entry and ensuring secure access to third-party applications without additional developer or user effort.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If traditional authentication protocols are used where users manually enter credentials, then security can be maintained, but user experience becomes clunky and time-consuming

Engineering Contradiction:

Improveuser experienceVSAvoidauthentication time

Core Design Contradiction:

Ease of operationVSLoss of time

Solution Approach 1:

The system performs preliminary authentication actions by having the bot website generate and store user credentials (access tokens, user IDs) in advance during the initial login process. When the bot needs to access the user's account, these pre-stored credentials are automatically transmitted without requiring the user to re-enter them, thus improving ease of operation and reducing authentication time.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The messaging application acts as an intermediary that facilitates automatic credential transmission between the bot website and the bot. The intermediary receives credentials from the website and automatically forwards them to the bot, eliminating the need for manual user input while maintaining secure authentication.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If manual credential copying and pasting is required, then authentication can be performed, but network traffic increases and user experience deteriorates

Engineering Contradiction:

Improveauthentication securityVSAvoidnetwork traffic

Core Design Contradiction:

ReliabilityVSQuantity of substance

Solution Approach 1:

The system extracts the credential transmission process from the manual copying and pasting workflow. Instead of requiring users to copy large identification numbers and paste them into chat messages, the credentials are automatically extracted and transmitted through the messaging application's API, reducing network traffic and improving reliability.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The manual mechanical process of copying and pasting credentials is replaced with an automated electronic system. The messaging application programmatically transmits credentials from the website to the bot, eliminating the need for manual user actions and reducing network traffic overhead.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Measurement precision

If the bot website stores user credentials, then authentication can be verified, but security risks increase if credentials are exposed

Engineering Contradiction:

Improveauthentication verificationVSAvoidsecurity exposure

Core Design Contradiction:

Measurement precisionVSObject-affected harmful factors

Solution Approach 1:

The system segments the credential storage and transmission process into distinct components: the bot website stores credentials securely in its database, the messaging application transmits them through encrypted channels, and the bot receives and uses them temporarily. This segmentation allows verification while limiting exposure at each stage.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system creates a secure, controlled environment for credential transmission by using the messaging application's encrypted communication channels and authenticated APIs. This inert atmosphere protects credentials from exposure during transmission, allowing verification while maintaining security.

Inventive Principle:

Principle #39Inert atmosphere (Inert environment)

Data Source

PatentEP3622427B1Securely authenticating a bot user

Publication Date: 2025.03.26 MICROSOFT TECHNOLOGY LICENSING LLC

Figure 1
Figure 2
Figure 3

AI summary

Systems and methods are provided that securely authenticate a user of a web application. For example, the user may utilize a bot from within a first application, such as a chat application. The user may request the bot to access a second application (e.g., a social-networking application) that is remote from the first application. If the bot does not have authorization, the bot may redirect the user to a webpage for the second application, where the user may enter login credentials. Upon verification, the second application may provide an access token to a webpage associated with the bot. To authenticate the bot user, the bot webpage may generate and cache a nonce that is transmitted back to the first application, which then transmits it to the bot. The bot may then compare the received nonce with the cached nonce. If the nonces match, the user may be securely authenticated.